{"id":"CVE-2024-40457","aliases":["EUVD-2024-38462","GHSA-6v48-p2g5-g5g2"],"status":"disputed","title":"No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command...","description":"No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00648,"percentile":0.51398,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-312","CWE-313"],"published":"2024-09-12T00:00:00Z","modified":"2026-06-17T07:45:54Z","exploits":[{"source":"pocgithub","id":"jeppojeps/CVE-2024-40457-PoC","title":"jeppojeps/CVE-2024-40457-PoC","date":"2024-10-30","url":"https://github.com/jeppojeps/CVE-2024-40457-PoC"}],"products":[{"vendor":"no-ip","product":"duc"}],"references":[{"url":"https://www.noip.com/support/knowledgebase/install-linux-3-x-dynamic-update-client-duc"},{"url":"https://www.noip.com/support/knowledgebase/running-linux-duc-v3-0-startup-2"},{"url":"https://github.com/jeppojeps/CVE-2024-40457-PoC"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40457"},{"url":"https://github.com/advisories/GHSA-6v48-p2g5-g5g2"}],"sources":{"cve":[{"id":"CVE-2024-40457","description":"No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.","status":"disputed","published":"2024-09-12T00:00:00Z","modified":"2024-10-31T19:43:08.722Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:34:06.811965Z"}],"euvd":[{"id":"EUVD-2024-38462","description":"No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.","status":"published","published":"2024-09-12T00:00:00Z","modified":"2024-10-31T19:43:08Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T00:05:13.001555Z"}],"ghsa":[{"id":"GHSA-6v48-p2g5-g5g2","title":"No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command...","description":"No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.","status":"published","published":"2024-09-12T15:33:01Z","modified":"2024-10-31T21:32:48Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-312","CWE-313"],"updated_at":"2026-11-02T14:58:40.851254Z"}],"nvd":[{"id":"CVE-2024-40457","description":"No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.","status":"disputed","published":"2024-09-12T14:16:06.78Z","modified":"2026-06-17T07:45:54.15Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:10:25.561537Z"}]}}